PrithviBadiga commented on code in PR #65692:
URL: https://github.com/apache/airflow/pull/65692#discussion_r3133015973
##########
providers/microsoft/azure/src/airflow/providers/microsoft/azure/secrets/key_vault.py:
##########
@@ -200,17 +207,41 @@ def build_path(path_prefix: str, secret_id: str, sep: str
= "-") -> str:
path = f"{path_prefix}{sep}{secret_id}"
return path.replace("_", sep)
- def _get_secret(self, path_prefix: str, secret_id: str) -> str | None:
+ def _build_team_secret_name(self, path_prefix: str, team_name: str,
secret_id: str) -> str:
+ """Build a team-scoped secret name using a dedicated separator before
the secret id."""
+ team_prefix = self.build_path(path_prefix, team_name, self.sep)
+ normalized_secret_id = secret_id.replace("_", self.sep)
+ return f"{team_prefix}{self.TEAM_SEP}{normalized_secret_id}"
+
+ def _is_team_specific_accessed_as_global(self, secret_id: str, team_name:
str | None = None) -> bool:
+ normalized_secret_id = secret_id.replace("_", self.sep)
+ team_pattern =
rf"[^{re.escape(self.sep)}]+{re.escape(self.TEAM_SEP)}.+"
+ return team_name is None and bool(re.fullmatch(team_pattern,
normalized_secret_id))
Review Comment:
I simplified that guard to make it clearer.
The normalization is there because Azure secret names go through the same
underscore-to-separator conversion as `build_path`, so I now reuse that
normalization directly before checking whether the id already looks
team-scoped. I also removed the extra `team_pattern` variable and replaced it
with a simpler check based on the dedicated `--` separator.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
